Ransomware Detection Using Markov Chain Models Over File Headers

Nicolas Bailluet (1) , Hélène Le Bouder (2, 3) , David Lubicz (4)

1 ENS Rennes - École normale supérieure - Rennes
2 OCIF - Objets communicants pour l'Internet du futur
3 IMT Atlantique - SRCD - Département Systèmes Réseaux, Cybersécurité et Droit du numérique
4 CELAR / DGA - Centre Electronique de l'Armement [Bruz]

In this paper, a new approach for the detection of ransomware based on the runtime analysis of their behaviour is presented. The main idea is to get samples by using a mini-filter to intercept write requests, then decide if a sample corresponds to a benign or a malicious write request. To do so, in a learning phase, statistical models of structured file headers are built using Markov chains. Then in a detection phase, a maximum likelihood test is used to decide if a sample provided by a write request is normal or malicious. We introduce new statistical distances between two Markov chains, which are variants of the Kullback-Leibler divergence, which measure the efficiency of a maximum likelihood test to distinguish between two distributions given by Markov chains. This distance and extensive experiments are used to demonstrate the relevance of our method.

Mots clés: Ransomware; Detection; Malware; Markov Chain; File Header

Domaines: Cryptographie et sécurité [cs.CR]

Nicolas Bailluet, Hélène Le Bouder, David Lubicz. Ransomware Detection Using Markov Chain Models Over File Headers. SECRYPT 2019 : 16th International Conference on Security and Cryptography, Jul 2021, visioconference, Portugal. ⟨10.5220/0010513104030411⟩. ⟨hal-03281541⟩